v0.7.2

Added

• Operator OTLP metrics now expose database inspection cost. The operator records inspection phase durations, inspected object counts, wildcard inventory size, unsatisfied wildcard scope counts, and grantability query/object counts so large-schema deployments can spot catalog-query regressions.

Changed

• Wildcard diagnostics now avoid grantability catalog scans when current ACLs already satisfy the wildcard, and scope grantability checks to the unsatisfied wildcard schema/object-type pairs.

Fixed

• Unsatisfiable wildcard grants now fail with a clear diagnostic instead of re-planning forever. A wildcard such as function name: "*" remains strict desired state: every matching object must either already have the requested privilege or be grantable by the executor. When a matching object is missing the privilege and the executor lacks the corresponding WITH GRANT OPTION, CLI diff/plan/apply now stop with UnsatisfiableWildcardGrant instead of printing or applying repeated wildcard SQL. The operator reports Ready=False and Degraded=True with the same reason, leaves no new PostgresPolicyPlan or SQL ConfigMap for that reconcile, and retries at the normal policy interval. (#105, #106)

What's Changed

• Fix unsatisfiable wildcard grant churn by @hardbyte in #106
• Prepare v0.7.2 release by @hardbyte in #107

Full Changelog: v0.7.1...v0.7.2